HIPAA Compliance News

Lawsuits Filed Over Alleged HIPAA Violations

Posted by HIPAA Journal

Two lawsuits have recently been filed in relation to alleged breaches of Health Insurance Portability and Accountability Act (HIPAA) Rules, one by a former hospital employee and another by a patient whose privacy was allegedly violated by a CVS pharmacy employee.

Former Employee of Mosaic Life Care Medical Center Takes Legal Action over Dismissal

A former employee of Mosaic Life Care Medical Center in St. Joseph, MO is taking legal action over wrongful discharge and retaliation for her taking steps to avoid a violation of the False Claims Act.

Debra Conard, 57, alleges she was wrongfully terminated for raising concerns about unlawful, unethical, and fraudulent billing practices. According to the lawsuit, in April 2017, Conard was instructed by hospital officials to release charges for billing even though the documentation did not support the claims. Multiple charges were required to be pushed through, which would induce payment by Medicare and other third parties, even though Conrad could not verify that the claims were correct.

Conrad raised her concerns about potential violations of the False Claims Act and told her supervisor of the possibility of substantial fines. Under instruction, Conrad processed the claims but also included notes stating that the claims were not supported by the documentation and the claims had been authorized to be released even though she believed them to be fraudulent claims.

Conrad was subjected to disciplinary action, including suspension, which was due to her opposition to fraudulent billing. She complained about the disciplinary actions and was later accused of violating HIPAA Rules. She also complained about that allegation and was fired shortly after.

The lawsuit states, “Merely because plaintiff could see patient information while performing duties in the coding program (that she needed to access to perform her job), she was subject to discipline and suspension.” Conrad is seeking $75,000 in compensatory damages, lost wages, lost benefits, attorneys’ fees, and reinstatement.

Lawsuit Filed over Alleged Disclosure of Viagra Prescription

A New York man is taking legal action against CVS Pharmacy over an alleged privacy violation in which details of his prescriptions were disclosed over the telephone to his wife. The man had visited a Long Island branch of the pharmacy chain to fill a prescription for 100 mg of Viagra with five refills. The man wanted to pay for the drug personally rather than have it covered by his insurance.

The man’s wife contacted the same pharmacy by telephone a few days later about an unrelated matter and was allegedly told about her husband’s Viagra prescription over the telephone by a CVS Pharmacy employee. As a result of the disclosure, the main claims his marriage is broken and he has suffered a “genuine, severe mental injury and emotional harm”.

The man, identified as Michael Feinberg, claims his wife had no right to be told about his medication and that by disclosing the information to a third party (his wife) the pharmacy violated the HIPAA Privacy Rule.

Legal Action Being Considered Over EMS Worker’s Facebook Post

A woman from Roane County, TN, is considering taking legal action over a Facebook post made by an EMS worker who visited her property to provide treatment to her husband who had collapsed after suffering a heart attack while in his chicken coop.

Kathy Raymond attempted to save her husband’s life by providing cardiopulmonary resuscitation until the emergency services team arrived. They took over but were unable to save her husband’s life.

Following the visit, an EMS worker posted a message on Facebook about the incident. The message was – “well, we had a first … We worked a code in a chicken coop! Knee deep in chicken droppings.” WATE reports that further comments were added to the post by the worker, who stated, “it was awful” and that “I’m pretty sure y’all could smell us in dispatch.”

Raymond contacted Roane County EMS to complain about the EMS worker’s unprofessional and insensitive behavior and the matter was investigated internally.

No PHI was mentioned in the post although questions have been raised over a possible HIPAA violation. Since no PHI was disclosed, the county attorney does not believe HIPAA has been violated, but did say that the post should not have been made on social media.

The employee concerned has been reprimanded and talks have been scheduled with EMS workers to explain that no work matters should be discussed or posted on Facebook.

Raymond was not happy with the response to the incident and said, “this is wrong for her to just get a slap on the wrist. I don’t want her to be able to have a job as an EMS worker if she does not have more compassion than that. Even though she did not mention his name, she said it was the first time they had ever had a call in a chicken coop. Everybody knows where my husband died.”

The post Lawsuits Filed Over Alleged HIPAA Violations appeared first on HIPAA Journal.

Colorado Governor Signs Data Protection Bill into Law

Posted by HIPAA Journal

Colorado Governor John Hickenlooper has signed a bill – HB 1128 – into law that strengthens protections for consumer data in the state of Colorado. The bipartisan bill, sponsored by Reps. Cole Wist (R) and Jeff Bridges (D) and Sens. Kent Lambert (R) and Lois Court (D), was unanimously passed by the Legislature. The bill will take effect from September 1, 2018.

The bill requires organizations operating in the state of Colorado to implement reasonable security measures and practices to ensure the personal identifying information (PII) of state residents is protected. The bill also reduces the time for notifying the state attorney general about breaches of PII and introduces new rules for disposing of PII when it is no longer required.

Personal information is classed as first name and last name or first initial and last name in combination with any of the following data elements (when not encrypted, redacted, or secured by another means that renders the information unreadable):

  • Social Security number
  • Student ID number
  • Military ID number
  • Passport number
  • Driver’s license number or ID card number
  • Medical information
  • Health insurance ID number
  • Biometric data
  • Email addresses in combination with passwords or security Q&As
  • Financial account numbers, and credit cards and debit cards with associated security codes that would permit access/use

Reasonable Security Measures Must be Implemented

Covered entities will be required to implement and maintain “Reasonable security procedures and practices that are appropriate to the nature of the personal identifying information and the nature and size of the business and its operations.” Those measures should protect PII from unauthorized access, modification, disclosure, and destruction. In cases where PII is passed to a third party, the covered entity must ensure the third party also has reasonable security measures in place.

A written policy must be developed by all businesses that maintain the personal information of Colorado residents covering the disposal of that information when it is no longer required. Electronic data and physical documents containing PII must be disposed of securely. The bill suggests “Shredding, erasing, or otherwise modifying the personal identifying information in the paper or electronic documents to make the personal identifying information unreadable or indecipherable through any means.”

30-Day Maximum Time Limit for Issuing Breach Notifications

When the bill was first introduced, it required the state attorney general to be notified of a breach of PII within 7 days of discovery. Such a short time frame for issuing notifications can help to ensure prompt action is taken to prevent harm or loss, although such a short time frame means notifications would need to be issued before it would be possible, in many cases, to determine whether there had been any misuse of data. This requirement of the bill attracted considerable criticism from large businesses operating in Colorado.

After careful consideration, this requirement was amended and the time limit for issuing notifications has been extended to 30 days following the discovery of the breach. Even so, this makes the notification requirements the strictest of any state.  The state attorney general only needs to be notified of the breach if it has impacted more than 500 Colorado residents. Regardless of the scale of the breach, affected individuals must be notified within 30 days.

HIPAA-covered entities should note that the 30-day time limit will apply even though HIPAA allows up to 60 days to issue notifications. HIPAA-covered entities and entities covered by the Gramm-Leach-Bliley Act are not exempt.

Breach notices are required for any security breach that exposes personal information, except a good faith acquisition of personal information by an employee or agent of a covered entity if the information is not used for a purpose unrelated to the lawful operation of the business and if that information is not subject to further unauthorized disclosure.

A notice must also be placed on the website of the breached entity and a notification issued to statewide media.

The post Colorado Governor Signs Data Protection Bill into Law appeared first on HIPAA Journal.

Could Law Firms Targeting Patients in ER Rooms Using Geofencing Technology Violate HIPAA?

Posted by HIPAA Journal

Questions are being raised about whether HIPAA Rules are being violated when attorneys send text messages and push notifications to patients who have visited emergency rooms and other medical facilities using geofencing technology.

Marketers are using a range of clever tactics to sell products and services such as remarketing – The displaying of advertisements on websites to individuals who have previously viewed products on another website but not made a purchase.

Similarly, the use of geofencing is growing in popularity. Geofencing is the creation of a digital fence around a specific location. When an individual crosses that invisible boundary, a push notification is sent to the users mobile phone. That location could be a store or any location. Retailers have been using the technology for some time, Google sends push notifications based on location, and now attorneys are getting in on the act.

This tactic of targeting specific individuals is being offered by at least one digital marketing firm and the service is being offered to attorneys. In this case the geofence is around healthcare facilities, specifically emergency rooms. When an individual enters the ER, they are sent a push notification through their phone offering them legal assistance.

NPR reports that Tell All Digital, a New York marketing firm, has been offering this service to law firms and there is no shortage of takers. It is one of the biggest growth areas for the firm and lawyers from several states are trialling the marketing tactic.

The benefits to attorneys are clear. The technology allows the attorney to be virtually in an Emergency Room or healthcare facility targeting individuals who have more than likely been injured. They are sent advertisements about the option of making a personal injury claim. While only a percentage of patients will have a valid claim, it certainly improves the odds of finding a prospective client.

As with remarketing, an individual can be targeted with adverts for a set period after the visit. Potentially ads or messages could be received for up to a month after a visit to an emergency room, according to the NPR report.

While it is certainly an innovative way for attorneys to find clients that have a higher than average chance of qualifying for a personal injury claim, many view this as an invasion of privacy. But could this also constitute a violation of HIPAA?

HIPAA Rules apply to healthcare providers, health plans, healthcare clearinghouses and business associates of HIPAA covered entities. While attorneys can certainly be business associates, HIPAA Rules would be unlikely to apply in this case.

HIPAA covered entities are not supplying any protected health information, the only information that is being supplied is the fact that an individual is in a medical facility, and that information is not passed over by any healthcare company.

While this tactic may not be a violation of HIPAA Rules, it could certainly violate state laws or federal laws other than HIPAA. NPR cites a settlement that was reached last year over similar tactics used by an advertising company to target women who had visited reproductive healthcare facilities. In that case, Copley Advertising set geofences around reproductive health centers and methadone clinics. They were sent messages such as ‘Pregnancy Help’, ‘You Have Choices’, and ‘You Are Not Alone’, with the clients including a Christian pregnancy counselling and adoption agency.

Massachusetts’ attorney general Maura Healey took action and reached a settlement with the advertising agency over potential violations of state consumer protection laws, which the use of geofencing allegedly violated. Under the settlement, Copley was prohibited from using geofencing technology in the state of Massachusetts at or near healthcare facilities to infer the health status or medical conditions of individuals. Healey claimed the actions were tantamount to digital harassment.

Whether the practice violates state laws is open to interpretation, although as the practice appears to be gaining momentum, regulators may have to step in, certainly with respect to visits to healthcare facilities.

While this may not be a matter for the HHS to deal with, it could be dealt with at the state level or it is possible this is more in the realm of the Federal Trade Commission. However, whether the practice actually violates any laws is unclear. What is clear is that unless action is taken, the practice will continue, and its popularity will likely grow.

The post Could Law Firms Targeting Patients in ER Rooms Using Geofencing Technology Violate HIPAA? appeared first on HIPAA Journal.

Aetna Files Further Lawsuit in an Attempt to Recover Costs from 2017 HIV Status Privacy Breach

Posted by HIPAA Journal

There have been further developments in the ongoing legal battles over a 2017 privacy breach experienced by Aetna involving the exposure of patients’ sensitive health information. A further lawsuit has been filed by the insurer in an attempt to recover the costs incurred as a result of the breach.

Ongoing Legal Battles Over the Exposure of Patients’ HIV Statuses

In 2017, the health insurer Aetna experienced a data breach that saw highly sensitive patient information impermissibly disclosed to other individuals. A mailing vendor sent letters to patients using envelopes with clear plastic windows and information about HIV medications were allegedly visible. The mailings related to HIV medications used to treat patients who had already contracted HIV and individuals who were taking drugs as pre-exposure prophylaxis. Approximately 12,000 patients received the mailing.

Lawsuits were filed on behalf of patients whose HIV positive status was impermissibly disclosed, which were settled in January for $17.2 million. A settlement was agreed with the New York state attorney general for a further $1.15 million to resolve the privacy violations.

Following on from those settlements, Aetna attempted to recover the cost of the settlements from Kurtzman Carson Consultants, the administrator who allegedly directed the mailing vendor to send the letters to patients that exposed their PHI. Aetna maintains that Kurtzman Carson Consultants did not communicate to Aetna that the mailing was being sent using windowed envelopes. The lawsuit is ongoing.

Further Lawsuit Filed Against Two Firms Representing Breach Victims

Now a lawsuit has been filed by Aetna against the law firm Whatley Kallas and the Californian advocacy group Consumer Watchdog in an attempt to recover at least part of the $20 million in settlements already paid. Consumer Watchdog and Whatley Kallas represented patients in a previous case that led to the sending of the notification letters that exposed patients’ sensitive information.

The privacy breach that led to the $20 million settlement occurred in response to a previous privacy incident that Aetna was sued over. That initial privacy breach related to a requirement for patients who had been prescribed HIV medication to receive the drugs by mail rather than collecting them in person. Since the drugs need to be kept refrigerated, and are dispatched in refrigerated containers, it was alleged that this would violate patients’ privacy as it would be clear to neighbors and co-workers that HIV drugs were being delivered.

The latest lawsuit alleges the plaintiffs were responsible for requiring Aetna to send sensitive information to the Kurtzman Carson Consultants, which Aetna was against and that after that information was passed to Kurtzman Carson Consultants, the plaintiffs failed to ensure the confidential information was protected.

Whatley Kallas had recommended using Kurtzman Carson Consultants and Consumer Watchdog were involved to make sure Aetna made good on its promise to change the requirements for patients to have the drugs sent by mail.

Harvey Rosenfield and Jerry Flanagan of Consumer Watchdog explained to Reuters, that they “edited the text of the letter to make sure we held Aetna’s feet to the fire,” but did not receive any protected health information and were not aware that windowed envelopes were being used and maintain Aetna is making “frivolous claims.”

“If Aetna believes that an attack on lawyers for Consumer Watchdog and Whatley Kallas LLP will be a cost-free exercise in retaliation, it is deeply mistaken,” wrote Rosenfield and Flanagan in a letter to the insurer, concluding “Aetna would be well advised to focus on remediation of its privacy practices on a nationwide basis as we are seeking in this action, instead of pursuing abusive and retaliatory tactics that seek to evade liability for its own failings and suggest that Aetna still does not take responsibility for ensuring that its customers’ private medical information is protected.”

While this may appear to be a case of passing the buck at face value, the case is not as frivolous as it may sound. According to Aetna, the law firm representing the plaintiffs in the original case were allegedly party to a proposal that stated windowed envelopes were going to be used, but the law firm failed to raise a red flag.

The post Aetna Files Further Lawsuit in an Attempt to Recover Costs from 2017 HIV Status Privacy Breach appeared first on HIPAA Journal.

OCR Reminds Covered Entities Not to Overlook Physical Security Controls

Posted by HIPAA Journal

The Department of Health and Human Services’ Office for Civil Rights (OCR) has reminded covered entities that HIPAA not only requires technical controls to be implemented to ensure the confidentiality, integrity, and availability of protected health information, but also appropriate physical security controls.

Physical controls are often the simplest and cheapest forms of protection to keep PHI private and confidential, yet these security controls are often overlooked. Some physical security controls cost nothing – such as ensuring portable electronic devices (laptop computers, portable storage devices, and pen drives) are locked away when they are not in use.

While this is a very basic form of security, it is one of the most effective ways of preventing theft and one that can prove incredibly costly if overlooked. OCR draws attention to a 2015 HIPAA breach settlement with Lahey Hospital and Medical Center. An unencrypted laptop computer was stolen from the Tufts Medical School affiliated teaching hospital resulting in the exposure 599 patients’ ePHI.

The laptop computer was used in connection with a computerized tomography (CT) scanner. The laptop was in an unlocked treatment room off an inner corridor of the radiology department. Lahey Hospital settled the case for $850,000. A high price to pay for failing to implement a free physical security control.

In 2014, QCA Health Plan agreed to settle potential HIPAA violations with OCR for $250,000. QCA Health plan failed to implement physical safeguards for all workstations to restrict access to ePHI to authorized users only. In that case, the workstation was an unencrypted laptop computer that was stolen from the vehicle of an employee.

In 2012, Massachusetts Eye and Ear Infirmary (MEEI) settled a HIPAA violation case with OCR for $1.5 million. This was another case of an unencrypted laptop computer being stolen that resulted in the impermissible disclosure of ePHI.

In 2016, OCR settled potential HIPAA violations with Feinstein Institute for Medical Research for $3.9 million. Feinstein Institute had failed to physically secure a laptop computer containing the ePHI of 13,000 patients. The device was also stolen from the vehicle of an employee.

In July 2016, University of Mississippi Medical Center settled a case with OCR for $2,750,000. An unencrypted laptop computer containing the ePHI of an estimated 10,000 patients was stolen from its Medical Intensive Care unit.

HIPAA requires covered entities and their business associates to implement “physical safeguards for all workstations that access ePHI to restrict access to authorized users.” Workstations include desktop computers, laptops, and other computing devices including portable storage devices, smartphones, and tablets.

It is up to HIPAA-covered entities and their business associates to decide on the most appropriate physical security controls to implement, which should be based on their risk analyses and risk management process.

Common physical security controls used to secure electronic devices and ePHI include:

  • Positioning desks to ensure screens cannot be easily viewed by anyone other than the user of a workstation
  • Privacy screens to prevent shoulder surfing
  • Cable locks to prevent electronic devices containing ePHI from being stolen
  • The use of security cameras to deter theft of electronic devices and physical PHI
  • Use of signage to remind employees about the need to use physical security controls
  • Use of port and device locks to prevent CD/DVD drives and USB connections from being used on workstations to copy ePHI and install unauthorized software.

The importance of preventing the use of USB drives by staff was highlighted in a recent study by Dtex Systems into insider threats. While the study was not conducted specifically on healthcare organizations, it did reveal that 90% of the risk assessments conducted on its customers and prospective customers revealed employees were transferring data to unencrypted USB devices.

As OCR explained in its May 2018 cybersecurity newsletter, “While the latest security solutions to combat new threats and vulnerabilities get much deserved attention, appropriate physical security controls are often overlooked.  Yet physical security controls remain essential and often cost-effective components of an organization’s overall information security program.”

The post OCR Reminds Covered Entities Not to Overlook Physical Security Controls appeared first on HIPAA Journal.

CMS Urged to Aggressively Enforce Compliance with HIPAA Administrative Simplifications

Posted by HIPAA Journal

The Department of Health and Human Services’ Office for Civil Rights is the primary enforcer of HIPAA Rules and has issued numerous financial penalties for HIPAA violations in response to complaints and data breaches. State attorneys general are also permitted to fine HIPAA-covered entities when violations of HIPAA Rules are discovered, and several state attorneys general have exercised that right. While the HHS’ Centers for Medicare & Medicaid Services is mandated to assist OCR with the enforcement of HIPAA Rules related to compliance with the HIPAA Administrative Simplifications, to date the CMS has not issued any fines.

The Medical Group Management Association (MGMA) believes that should change and the CMS should start enforcing compliance with HIPAA Rules that aim to reduce the administrative burden on healthcare providers.

In a recent letter to CMS, the MGMA explained it has received many complaints from members related to the failure of health plans to comply with HIPAA and ACA administrative simplification requirements. The lack of enforcement activity by the CMS in this area means there is no incentive for health plans to comply with the requirements relating to mandated transactions, national identifiers, code sets, and operating rules.

The letter, written by Anders Gilberg, MGA, Senior Vice President, Government Affairs, was submitted in response to a call for comments on the CMS complaint form. While comments specific to the complaint form were included in the letter, the MGMA also took it as an opportunity to criticize the CMS HIPAA administrative simplification enforcement process.

The CMS compliant form allows physician practices to formally file complaints against healthcare clearinghouses and health plans and notify CMS about HIPAA violations, although little action appears to be taken in response to those complaints.

MGMA explained in the letter that many health plans are not supporting national standards. Use of X12 270/271 (Eligibility & Benefit Verification) remains below 80%, X12 835 (Remittance Advice) is around 56%, use of the Electronic Funds Transfer transaction for payments has fallen from 62% to 60%, and use of the X12 278 (Prior Authorization) transaction has fallen from 18% to 8%.

MGMA notes that health plans are also trying to move providers away from using HIPAA standards to online portals. While there are benefits to the use of online portals, MGMA notes that “proprietary portals create a manual workflow process for providers and decreased revenue cycle automation.”

MGMA suggests CMS should step up its enforcement efforts to encourage health plans to comply with the HIPAA and ACA administrative simplification regulations. OCR has conducted HIPAA compliance audits, investigates complaints, and has issued multiple fines. Those fines are clearly communicated to the industry through news posts and press releases, making it clear that non-compliance will not be tolerated. OCR’s enforcement activities motivate HIPAA-covered entities to step up their efforts to comply with HIPAA Rules and also encourage individuals to report violations knowing that action will be taken.

“Health plans and clearinghouses unable or unwilling to support the administrative simplification standards and operating rules force providers to employ manual methods such as phone calls, facsimiles, and web portals, thus diverting scarce provider resources away from patient care,” wrote MGMA. Potentially millions of dollars in saving opportunities are going unrealized.

MGMA suggests CMS should implement random audits of health plans and healthcare clearinghouses to assess compliance with the administrative Simplifications, publish the names of covered entities that fail CMS audits, and list fines and corrective action plans that have been issued. MGMA also suggests the CMS should halt the voluntary Optimization Pilot for Administrative Simplification Transactions as it is likely to delay the commencement of an effective compliance-based audit program.

The post CMS Urged to Aggressively Enforce Compliance with HIPAA Administrative Simplifications appeared first on HIPAA Journal.

OCR Plans to Share HIPAA Violation Settlements with Breach Victims

Posted by HIPAA Journal

The Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted in 2009 and includes a provision that calls for the Department of Health and Human Services to share a percentage of HIPAA settlements with victims of HIPAA violations and data breaches.

This month has seen some progress in that area. The Department of Health and Human Services’ Office for Civil Rights has announced it is planning on issuing an advance notice of proposed rulemaking in November about sharing a percentage of the fines it collects through its HIPAA enforcement activities with the victims of data breaches.

OCR officials have previously made it clear that steps will be taken to meet the requirements of this HITECH provision, but little progress has been made. This is not the first time that OCR has announced it plans to issue an advance notice of proposed rulemaking on the matter only for the advance notice of proposed rulemaking to be delayed.

If OCR follows through on its plans this fall, feedback will be sought from the public and industry stakeholders on how it can achieve that aim and the methodology that should be employed.

One thing is clear, such a step would certainly be a challenge. How would OCR decide on the percentage of any HIPAA settlement or fine that should be paid to the victims of HIPAA violations and data breaches and how would it be possible to share the money fairly between affected patients?

Should every individual affected by a violation/breach receive an equal share of any settlement or should the amount received be determined by the type of PHI that has been exposed or the level of harm caused? In the case of the latter, how would it be possible to quantify harm and ensure appropriate payments are made?

Settlements to resolve HIPAA violations are not only determined by the number of individuals affected and the severity of the violation. OCR also takes the ability of a covered entity to pay a penalty into account. The amount paid to breach victims of virtually carbon-copy HIPAA violations at different covered entities would likely be vastly different.

The more people impacted by a data breach, the less the share would likely be for affected individuals. For example, New York Presbyterian Hospital settled HIPAA violations with OCR for $2,200,000 in 2016 and MAPFRE Life Insurance Company of Puerto Rico settled its case with OCR for the same amount. The NYPH settlement resolved violations that affected a handful of patients, whereas the MAPFRE breach impacted 2,200 individuals. The relative payments if the percentage was fixed would differ considerably.

Potentially, HIPAA financial penalties could significantly increase if a percentage of funds are given to breach victims to ensure patients get a reasonable payment, especially for HIPAA violations and data breaches where considerable harm has been caused – The unauthorized disclosure of the HIV positive status of a patient for example or breaches where patients’ PHI has clearly been obtained by identity thieves and used for malicious purposes.

The methodology used would have to be very carefully considered to ensure funds are shared fairly. Even if the advance notice of proposed rulemaking is issued in November, it is likely to be some time before a fair methodology is decided and any payments are made.

OCR has also proposed other rules that could see HIPAA Rules modified in the near future. OCR has proposed a change to the HIPAA Privacy Rule provision requiring healthcare providers to obtain acknowledgment from patients of receipt of the notice of privacy practices. Currently healthcare providers are required to make a good faith effort to obtain written acknowledgements from patients, or must explain why acknowledgements have not been obtained. That requirement could well be removed.

Feedback will also be sought from the public on modifications to the HIPAA Privacy Rule to incorporate the accounting of protected health information disclosures of the HITECH Act, which has not yet been implemented due to the perceived cost to healthcare organizations.

OCR also proposes a change to the HIPAA Privacy Rule – Presumption of Good Faith of HealthCare Providers – that would “clarify that healthcare providers are presumed to be acting in the individual’s best interests when they share information with an incapacitated patient’s family members unless there is evidence that a provider has acted in bad faith.”

The post OCR Plans to Share HIPAA Violation Settlements with Breach Victims appeared first on HIPAA Journal.

Jury Must Decide Whether Psychiatrist was Sacked for a HIPAA Violation

Posted by HIPAA Journal

Boston-based Steward Healthcare System terminated a psychiatrist for violating HIPAA Rules but must now prove to a jury that was the case. The psychiatrist claims he was fired in retaliation over taking extended disability leave, not for a HIPAA violation.

Dr. Alexander Lipin contracted pneumonia and requested extended disability leave under the Family Medical Leave Act (FMLA). Extended leave was granted by Steward Healthcare System and Lipin was due to return to work on March 2, 2016. However, Lipin was fired on February 23 while still on disability leave over a HIPAA violation, which his attorney, Kavita M. Goyal, claims was used as an excuse for the termination.

Steward Healthcare System alleged Lipin had violated HIPAA Rules by providing patients’ protected health information to law enforcement. According to Steward Medical Group President, George Clairmont, the decision had been taken to fire Lipin over the HIPAA violation before he took leave. Clairmont also stated Lipin was fired after it was discovered he was working for Anna Jaques Hospital while on leave.

Lipin sued Steward Medical Group inc., Steward Healthcare System, and Holy Family Hospital over his dismissal. The case was removed to federal court in November 2016, and Steward Healthcare filed a motion for a summary judgement on the case.

Massachusetts federal judge, Leo. T. Sorokin, ruled that the case should proceed to trial to establish the facts surrounding the dismissal. Steward Healthcare will now be required to convince a jury that the decision to fire the psychiatrist was based on the HIPAA violation and not the discovery that Lipin was working for another hospital while on disability leave.

Clairmont maintains the decision to fire Lipin was made before he went on leave on January 26. The HIPAA violation was discovered on January 16 and the decision was taken to fire Lipin. Lipin was not fired immediately as advice was sought from the company’s legal department over the nature of the termination – whether it should be for cause, effective immediately, or without cause, in which case 90 days’ notice or pay in lieu of notice would be required.

Lipin took leave and notified Steward Healthcare on February 5 that he would remain on leave until February 17, and on February 12 told Steward Healthcare that he would need to remain on leave until February 23. On February 20, leave was extended until March 2.

On February 13, Steward Healthcare learned that Lipin was continuing to work for Anna Jaques Hospital in the mornings while on leave, and Lipin was terminated ten days later on February 23.

While Judge Sorokin explained that no evidence exists in the record that directly contradicts Clairmont’s account, “A factfinder could reasonably choose to disregard Clairmont’s testimony in light of the lack of any action taken by Steward to arrange coverage for Lipin’s patients or to terminate Lipin’s employment before February 13, especially when this inaction is contrasted with Steward’s concerted steps to fire Lipin after February 13,” wrote Judge Sorokin, “These circumstances could support a reasonable inference that Steward decided to fire Lipin only after Clairmont learned of Lipin’s work at Anna Jaques.”

An initial pre-trail conference has been scheduled for May 30, 2018.

The post Jury Must Decide Whether Psychiatrist was Sacked for a HIPAA Violation appeared first on HIPAA Journal.

GAO: Medical Records Can be Difficult and Expensive to Obtain

Posted by HIPAA Journal

A recent audit conducted by the Government Accountability Office (GAO) has shown patients still face many challenges obtaining copies of their health information and healthcare providers and insurers are struggling to meet HIPAA requirements – and in some cases – are breaching HIPAA Rules.

A 21st Century Cures Act provision required GAO to conduct a study on patient access to medical records. The audit involved interviews with stakeholders, vendors, provider organizations, patient advocates, and state and HHS officials. The audit was conducted in four states – Ohio, Kentucky, Rhode Island and Wisconsin – which were chosen, in part, due to the range of fees charged for providing patients with copies of their medical records.

Under HIPAA, patients are permitted to request copies of their health records from their providers. Patients can request their health records in paper or digital form and the requests must be processed within 30 days. HIPAA-covered entities are allowed to charge a reasonable, cost-based fee for providing patients with copies of their health data.

Patients obtain copies of their health information for several reason: To take a more active role in their own healthcare, to take their medical records to new providers, to resolve disputes with their insurers, to provide to lawyers, or for disability claims.

Patients also make requests for their records to be forward on to another person or entity by their provider, such as when they want a second opinion from another physician. Third parties may also be instructed by patients to obtain copies of their health records – a lawyer for example.

The GAO audit determined that the fees charged by providers varied considerably from state to state and for different types of request.

Some states have established fee schedules, formulas and limits for allowable fees. Three of the states – Ohio, Rhode Island, and Wisconsin – have established per-page fee amounts and different rates for obtaining medical images such as copies of X-rays. Ohio has established a per-page fee amount for third party requests, Rhode Island has a maximum fee for providers that use an EHR for patient and patient-directed requests, while Kentucky allows patients to obtain one free copy of their medical records and sets a maximum charge of $1 per page for any additional copies.

While HIPAA stipulates that providers can only charge a reasonable, cost-based fee for patient requests and patient-directed requests, those limits do not apply to third party requests for copies of data, and the charges are often considerably higher.

Excessive Fees Charged for Providing Copies of Health Information

In 2016, the Department of Health and Human Services’ Office for Civil Rights issued guidance for HIPAA-covered entities on the fees that could be charged for providing patients with copies of their health information.  Even so, some providers are not following HIPAA Rules.

In the GAO report, examples are provided of the excessive fees that have been charged. One patient was charged a fee of $148 for a single PDF of their medical records, and two patients were each charged more than $500 for a single request to obtain a copy of their medical records. One patient was charged a retrieval fee by a release-of-information (ROI) vendor for a copy of her health records, even though such fees are not permitted under HIPAA. There have also been cases of providers charging annual subscription fees for providing access to medical records.

One problem faced by patients whose medical conditions have required many visits to physicians is the amount of data stored by their providers. Their health records span many pages and fees are charged per page. That can make obtaining copies of health records prohibitively expensive.

The GAO report indicates many patients have made attempts to obtain copies of their medical records from their providers but cancelled the requests when they discovered to cost of doing so. There have been cases where providers have refused patients who have requested copies of their health records and patients have failed to challenge their providers.

The report made it clear that even though efforts have been made to improve understanding of HIPAA Rules, many patients are still unsure of their rights under HIPAA.

Healthcare Organizations Face Major Challenges Providing Access to Health Records

It is not only a challenge for patients to obtain their health records. Many providers also face challenges finding and retrieving information and processing the requests. Often, patients’ data are stored in digital format and on paper/film. Paper records may be stored in different locations and digital records stored in multiple EHRs.

Many providers find it difficult to allocate the necessary resources to the task of providing copies of medical records to patients and staff struggle to find the time to process requests due to extremely busy workloads.

Thorough checks must be made of the records to make sure patients are only provided with data from their own records. Sometimes, the process of transferring data from physical records to digital versions result in different patient records being merged.

There are also security challenges. While HIPAA allows patients to receive digital copies of their data, on a memory stick for example, plugging in such a device could introduce a malware infection.

Some healthcare providers have eased the strain by making patient health information available through patient portals. This has helped reduce the number of requests for providing copies of health data. Unfortunately, patient portals do not contain entire health records and patients may not be able to get the information they need.

Interviews with OCR officials revealed hundreds of complaints have been submitted by patients who have experienced difficulties accessing their medical records. The most common complaints are the failure of a provider to process requests for copies of health information within 30 days, excessive fees for the information, the failure to respond to requests to send health records to caregivers and family members, and denying requests from parents to obtain copies of their children’s medical records.

OCR is currently considering whether any further guidance is required to clarify allowable fees under HIPAA Rules, further to the guidance it issued on the matter in 2016.

The post GAO: Medical Records Can be Difficult and Expensive to Obtain appeared first on HIPAA Journal.